Linux CVE-2026-64422

We need to produce a JSON object with the specified fields. The input provides CVE details, CVSS, EPSS, patch info, CPE, tags, affected versions, references. We must synthesize a comprehensive analysis.

Given data:

• CVE-2026-64422
• Description: In the Linux kernel, net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes... (full description given)
• CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
• EPSS: 0.23% (percentile 14%)
• Patch: Available from vendor (reported by Linux)
• CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (two entries, same)
• Tags: Buffer Overflow, Linux
• ENISA EUVD ID: EUVD-2026-48966
• Affected versions (EUVD): list of Linux version ranges and patches: e.g., "Linux patch: 0" (maybe meaning from version 0?), "Linux 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf <99206ce2244f8a3ed64298d0667c9055845a5dc7" (these look like commit hashes: the first is the base, the < indicates before the second commit. Might be that the vulnerability was introduced in commit 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf and fixed in commits like 99206ce2244f8a3ed64298d0667c9055845a5dc7, etc. Also specific version patches: 7.2-rc1, 7.1.4, 6.1.178, 6.12.96, 5.10.261, 6.18.39, 5.15.212, 6.6.145. And "Linux 2.6.24" as a base? Actually the intro commit might correspond to kernel 2.6.24 where tcp_reordering was introduced? Possibly. The list indicates many branches affected.

The description: "bound TCP reordering sysctl writes and MTU probe sizes". Exploit: negative net.ipv4.tcp_reordering sysctl write wraps to large u32 value, and with tcp_mtu_probing=2 the wrapped value can overflow size calculation causing out-of-bounds read. Fix: add bounds checks, make size_needed u64.

CVSS: AV:L, AC:L, PR:L, UI:N, S:U, C:H, I:N, A:H. So local attacker with low privileges can trigger out-of-bounds read leading to high confidentiality impact (info leak) and high availability impact (likely crash? Actually H for availability, maybe denial of service). No i